In Digital Signature Scheme, is it possible to forge a message just by knowing the secret key, or does the attacker should also know the hash function used by the original sender?

Also does the secret-public key pair change for every message or does it remain the same?

  • Forging a message is different from forging a signature. Digital signature generally contains information about hashing algorithm used. So if you have signing or secret key you can forge the signature but to forge a message you need to generate the message with similar hash i.e. collision or use the flaws with underlying hashing algorithm.
    – saurabh
    Jun 11, 2021 at 18:23
  • Secret public key pair change depends on the individual whether they use one key pair or multiple key pairs to sign the message.
    – saurabh
    Jun 11, 2021 at 18:54
  • @saurabh applications might put informations about the algorithm used but digital signature by itself does not contain algorithm information. That is not to say however that it is impossible to guess to some extent however. RSA for instance has much longer signature which is a number smaller than the public modulus. DSA and ECDSA both have shorter signatures comprising of two numbers both less than the prime (sub)-group order used. Jun 13, 2021 at 7:05
  • Digital signature contains digest algorithm information under SignerInfo. RFC5485. datatracker.ietf.org/doc/html/rfc5485#section-3.2.1.
    – saurabh
    Jun 13, 2021 at 8:05
  • However, some of the information could be skipped for e.g. OpenSSL cms provides -noattr option to skip some info.
    – saurabh
    Jun 13, 2021 at 9:05

1 Answer 1


Usually signature algorithm, (that includes how the message is hashed) is assumed to be known by attacker when we make such analysis.

Generally, signature keys are long term keys used many times. If you can perform second pre-image attack on hash function you can forge another message with the given message signature pair without knowing anything about the key. Forgery by hash collision (which is possible for MD5 and SHA1) however require crafting both messages by the attacker. Now to your another question, does knowing the secret key allow one to forge message (I think you meant finding different message for identical signatures) which verifies using the same original key. This is something undoable for as far as I know (I am not sure about this part) except by second pre-image attack.

However, there are things called key substitution attacks. Under a key substitution attack, a given message-signature pair, originally signed by a legitimate signer can be also made to be a valid message-signature pair when verified with a different key but one controlled by the attacker. I think mathematical details will be off-topic here so I won't go there. Most key substitution attack can be made without knowing the private key. You can also do the same with different message but this does not require knowing private key.

Another type of attack would be the one in which after knowing the private key used to generate a signature for a known message, we can find another message and key pair in which the same signature will be verified as a valid signature of new attacker chosen message. Keeping mathematical details to minimum, it is possible to so in some algorithms like (EC)DSA by finding x' such that H(m)+xr = H(m')+x'r mod q, where m' is an attacker chosen message and x' will be new attacker controlled private key. x is leaked private key of the legitimate signer. The original signature (r,s) verified against this new message (m') will pass with new public key y'=g^x'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .